Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/ai_proactive/plugin.py

@@ -59,7 +59,7 @@ class AIProactivePlugin(BasePlugin):
             from app.plugins.builtins.ai_proactive.context_tools import (
                 register_context_tools,
             )
-            from app.plugins.builtins.ai_assistant.tool_registry import (
+            from app.plugins.builtins.ai_assistant.contracts import (
                 get_tool_registry,
             )
 
@@ -73,7 +73,7 @@ class AIProactivePlugin(BasePlugin):
             from app.plugins.builtins.ai_proactive.participant_handler import (
                 AIProactiveParticipantHandler,
             )
-            from app.plugins.builtins.kommunikation.participant_registry import (
+            from app.plugins.builtins.kommunikation.contracts import (
                 get_participant_registry,
             )
 
@@ -87,7 +87,7 @@ class AIProactivePlugin(BasePlugin):
         """Unregister tools, event listeners, and participant."""
         # Unregister from participant registry
         try:
-            from app.plugins.builtins.kommunikation.participant_registry import (
+            from app.plugins.builtins.kommunikation.contracts import (
                 get_participant_registry,
             )
 
@@ -99,7 +99,7 @@ class AIProactivePlugin(BasePlugin):
         self._proactive_handler = None
 
         try:
-            from app.plugins.builtins.ai_assistant.tool_registry import (
+            from app.plugins.builtins.ai_assistant.contracts import (
                 get_tool_registry,
             )